mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 06:06:09 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2024-39330 -- Added extra file name validation in Storage's save method.

Browse Source 
Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah
Boyce for the reviews.
This commit is contained in:
Natalia
2024-03-20 13:55:21 -03:00
parent 5d86458579
commit fe4a0bbe20
7 changed files with 114 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tests/file_uploads/tests.py
View File

@@ -880,7 +880,7 @@ class DirectoryCreationTests(SimpleTestCase):
default_storage.delete(UPLOAD_TO)
# Create a file with the upload directory name
with SimpleUploadedFile(UPLOAD_TO, b"x") as file:
default_storage.save(UPLOAD_TO, file)
default_storage.save(UPLOAD_FOLDER, file)
self.addCleanup(default_storage.delete, UPLOAD_TO)
msg = "%s exists and is not a directory." % UPLOAD_TO
with self.assertRaisesMessage(FileExistsError, msg):